This is the compromised-maintainer attack, and it is different from a typosquat: the package is legitimate and trusted, only the latest release is poisoned. The attacker pushes a malicious version to the registry, and within hours it lands in everyone's build. The community usually catches it within hours to days, someone files an issue, the registry yanks the version. But every build that ran during that window pulled the payload. This is how Axios, TanStack, LiteLLM, DurableTask and several others got hit in 2024-2026. And pinning to old versions does not protect you if you ever re-resolve.
The fix is a cooldown window: refuse to install any package version published less than N days ago. N is a tradeoff. A few days catches most attacks; a few weeks catches almost all. Crucially, the window does not stop you using a package, it only delays adopting new releases of it. So by the time your build would install version X, either X is past your cutoff (proven good) or the registry has already yanked it (you are auto-protected). It is the single most powerful defense against this class.
pnpm 10+ supports it natively via .npmrc: minimum-release-age=Nd. npm has no built-in equivalent today; compensating controls are exact pins, npm ci rather than npm install, and a slower update cadence.
What cooldown does not cover: typosquats you install for the first time, existing pins silently widened by a default caret range, the package manager itself, and old versions with public CVEs. Layered defense: https://www.tigzig.com/agents-faq/how-to-protect-against-a-supply-chain-attack. Full item: https://www.tigzig.com/security/supply.
← All Agents FAQ